Towards Cooperative Games for Developing Secure Software in Agile SDLC

Abstract

This work applies Game Theory to developing secure software. With the perspective of Game Theory, one can see secure software development as a game between software developers and software security engineers, who play this game repeatedly in processes such as agile Software Development Life Cycle (SDLC). The problem we observe is that there can be conflicts between these two players regarding who should find and fix certain software vulnerabilities. To solve this problem, our approach uses Mechanism Design in Game Theory to design games that enforce cooperation between these two players. In doing so, we identify the source of the conflicts between them by looking at the components of the software. These components may be the methods or functions in the software, or individual modules, or similar building blocks. The novelty of our work is that our mechanism constructs a game which allocates software components between these two players such that they work cooperatively while trying to maximize their own payoffs.